Eugene Soltes’s Why They Do It: Inside the Mind of the White-Collar Criminal asks the question every fraud investigation leaves hanging: why did a wealthy, respected, intelligent executive with everything to lose do something that, in hindsight, looks both wrong and stupid? Soltes, a professor at Harvard Business School, spent years corresponding with and interviewing nearly fifty convicted executives, including Bernie Madoff, Enron’s Andrew Fastow, Tyco’s Dennis Kozlowski and the Ponzi schemers Marc Dreier and Allen Stanford, and his answer overturns the model most fraud training assumes. The executives did not weigh the gains against the risk of being caught; most of them did not experience their decisions as decisions at all. They acted on intuition, inside a culture that normalised what they did, at a distance from any victim they could see, and their later explanations were constructed after the fact. For an internal auditor the book is a challenge to the fraud triangle and to the deterrence logic behind many controls, and it offers a better account of what a control has to do to work. This guide summarises the book without reproducing it, sets out the argument and the cases, maps the findings to fraud risk assessment and control design, and ends with a worked example of a UK-listed company’s audit function applying the lens to management override.
In this guide
- The book in one page
- Who Eugene Soltes is, and how the book came about
- The structure: three parts
- The argument: intuition, distance and the absence of deliberation
- The cases: what the executives said
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: beyond the fraud triangle
- Fastow’s rule-following, and what it means for a control framework
- The criticisms, and the limits of the evidence
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Pennine Foods applies the lens to management override
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is the question? | Why successful executives commit white-collar crimes whose expected cost, to any rational observer, far exceeds the gain. |
| What is the standard answer? | That they calculate: the gain is large, the probability of detection small, the penalty bearable. This is the economic model of crime, and it underlies the deterrence logic of penalties, hotlines and “tone at the top” messaging. |
| What does Soltes find? | That the calculation rarely happened. The executives he studied acted quickly and intuitively, inside norms that made the act seem ordinary, without a vivid sense of anyone being harmed, and rationalised afterwards. Many could not reconstruct a moment of decision. |
| Why does distance matter? | White-collar harm is diffuse and remote: shareholders, counterparties, the market. The moral instincts that stop people from harming someone in front of them do not fire when the victim is a spreadsheet. |
| What follows for prevention? | That deterrence has limits, that culture and norms do most of the work, and that effective controls create the pause, the visibility and the vividness that intuition lacks: a second person, a question, a face. |
| Why read it as an auditor? | Because fraud risk assessment is built on a model of the offender, and if the model is wrong, the controls designed from it are aimed at the wrong moment. The book also explains why management override is the hardest fraud to prevent and what makes it more likely. |
| Reading time | About thirteen hours for the 450-page paperback; the interviews are the heart of it and should not be skimmed. |
Who Eugene Soltes is, and how the book came about
Soltes teaches at Harvard Business School, where his research covers corporate misconduct, compliance and the measurement of ethical behaviour inside firms. The book grew out of a long correspondence with convicted executives, which became a method. Over several years Soltes exchanged letters, calls and visits with dozens of people convicted of insider trading, accounting fraud, Ponzi schemes and other financial crimes, and supplemented the interviews with the research literatures on moral psychology, behavioural economics and criminology. PublicAffairs published the book in October 2016. Soltes has since worked on compliance measurement and on how companies can assess whether their programmes work, which is the question his book leaves the reader with.
The structure: three parts
| Part | What it covers | What it contributes |
|---|---|---|
| Part one: the struggle to criminalize | The history of the idea, from Edwin Sutherland’s coining of the term in 1939 through the prosecutions of the 1980s and 2000s; why the law treats these crimes differently | The background: how executives came to be prosecuted as criminals |
| Part two: nature or nurture? Reasoning or intuition? | The calculating model of the offender and its limits; intuition versus deliberation; moral judgment as fast and emotional; the role of distance from harm; how norms inside a firm or an industry redefine what is acceptable; the construction of justifications after the fact | The alternative explanation |
| Part three: the business of malfeasance | Chapters organised by crime: misleading disclosure, financial reporting fraud, insider trading, deceptive financial structures and the Ponzi scheme, closing with a chapter on Madoff; the interviews with Madoff, Fastow, Kozlowski, Dreier, Hoffenberg and others | The evidence, in the offenders’ own words |
| Conclusion | What might reduce white-collar crime: making harm vivid, changing norms, building friction into decisions, and the limits of punishment | The prescription, offered cautiously |
The argument: intuition, distance and the absence of deliberation
The economic model of crime, associated with Gary Becker, treats the offender as a calculator: he offends when the expected gain exceeds the expected cost, where the cost is the penalty discounted by the probability of being caught. Deterrence follows: raise the penalty or the probability and the crime falls. Soltes’s executives do not fit. They were already rich; the gains were often small relative to their wealth; the penalties were catastrophic and, for many, foreseeable. Had they calculated, most would not have acted. The interviews point instead to the research on moral intuition: judgments about right and wrong are made quickly and emotionally, and reasoning arrives afterwards to defend them. In the environments these executives inhabited, the intuitive signal that something was wrong was weak or absent, for three reasons the book develops at length.
| Mechanism | What Soltes describes | What it looks like inside an organisation |
|---|---|---|
| No moment of decision | Executives describe drifting into the conduct through a series of small steps, none of which felt like crossing a line; several could not identify when the fraud began | A reserve adjusted a little further each quarter; a disclosure deferred one more time |
| Distance from harm | The victims of financial crime are abstract and remote; the moral emotions that restrain face-to-face harm do not engage | Decisions taken about “the market”, “the shareholders” or “the counterparty” rather than about people |
| Norms of the environment | Conduct that is common in a firm or an industry stops registering as wrong; the executives compared themselves with peers, not with the law | Aggressive accounting that “everyone” does; gifts that are customary in a market |
| Intuition under pressure | Decisions made fast, in meetings, under stress, with no time or structure for deliberation | The quarter-end call; the board meeting the night before results |
| Post-hoc justification | Reasons produced afterwards, sincerely believed, that did not operate at the time | The explanations given to investigators and the explanations that would have satisfied a reviewer |
| The hole | Once a problem exists, concealing it feels like protecting the firm, and each quarter deepens it | A misstatement maintained for years because correcting it would reveal the first one |
The conclusion Soltes draws is not that these executives were blameless, and he is careful about that; it is that prevention aimed at the calculating offender misses the actual mechanism. What interrupts intuition is not a larger penalty in a policy nobody reads but a structure that forces a pause, makes the harm visible and puts another person in the room. That is a description of a control, and it is the reason the book belongs on an auditor’s shelf.
The cases: what the executives said
| Executive and case | What happened | What the interviews added |
|---|---|---|
| Bernie Madoff | A Ponzi scheme running for decades through his investment advisory business, collapsing in December 2008 with paper losses of about $65 billion | Madoff described the fraud as beginning as a temporary cover for losses he expected to recover, and dwelt on the clients’ pressure for steady returns; Soltes treats the account as self-serving and revealing at once |
| Andrew Fastow, Enron | The chief financial officer who built the off-balance-sheet partnerships that hid Enron’s debt and enriched him; pleaded guilty in 2004 | Fastow’s point, which he has repeated in talks to auditors, is that the structures were approved by lawyers, accountants and the board, and that approval made them feel legitimate; the rules were followed and the principle was violated |
| Dennis Kozlowski, Tyco | Convicted in 2005 of looting the company through unauthorised bonuses and loans | He maintained that the payments were approved or customary; the interviews illustrate the norm argument and its limits |
| Marc Dreier | A lawyer who sold fictitious notes to hedge funds, 2008, to fund his firm’s expenses | The hole: a shortfall covered by a first fraud that then had to be fed |
| Steven Hoffenberg | A Ponzi scheme through a collections company, early 1990s | An early case of the pattern; the pressure to maintain appearances |
The corporate scandals guide sets the Enron, Tyco and Madoff cases in a comparative frame, and the Smartest Guys in the Room summary gives the Enron story in full; Soltes adds the offenders’ own accounts, which are the part no investigation report contains.
The nine ideas worth keeping
- Most white-collar offenders did not calculate. The deterrence model describes a minority; the majority acted on intuition inside permissive norms. Controls built on deterrence alone are aimed at the wrong person.
- There is often no moment of decision. Fraud is a slope, not a step; the control has to catch the first small movement, which is why a change in a reserve, an estimate or a disclosure practice is the auditor’s signal.
- Distance disables conscience. The further the harm from the decision, the weaker the intuitive restraint. Making harm vivid, naming the people affected, is a control technique, not a communications exercise.
- Norms beat policies. What colleagues do defines what is acceptable; a code of conduct that contradicts practice loses. The culture audit guide tests practice, not the code.
- Approval can launder a decision. Fastow’s structures were signed off by experts, and the signatures made them feel legitimate. A control that approves without challenging adds legitimacy to whatever it approves.
- The hole deepens. Concealment feels like loyalty; each period’s cover-up is justified by the last. The longer a misstatement has lasted, the stronger the motive to maintain it, which inverts the usual assumption that old issues are stable.
- Justifications come afterwards. An explanation that satisfies the auditor may be one the executive constructed after acting; the test is whether the reasoning existed at the time, in writing, before the outcome was known.
- Friction is protective. A pause, a second person, a required question, a day’s delay: structures that convert an intuitive act into a deliberate one are where prevention happens.
- Measure the programme, not the training. Soltes’s later work argues that compliance should be assessed by whether behaviour changes, not by completion rates.
The vocabulary: fourteen terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| White-collar crime | Sutherland’s term for crime committed by persons of respectability in the course of their occupation | The fraud risk universe above the transaction level |
| Economic model of crime | Offending as a cost-benefit calculation | The assumption behind deterrence-based controls |
| Moral intuition | Fast, emotional judgment of right and wrong, followed by reasoning | Why training on consequences changes little |
| Psychological distance | Remoteness of the harm from the actor | Why financial misstatement feels different from theft |
| Normalisation | Conduct becoming acceptable through repetition and peer example | The practice the function should test against the code |
| Rationalisation | The fraud triangle’s third element; in Soltes’s account, mostly post-hoc | Explanations to test against contemporaneous records |
| The hole | A concealed problem that grows because disclosure would reveal it | Long-running estimates and reserves that are never released |
| Management override | Senior people bypassing controls designed for everyone else | The fraud the triangle explains least and the book explains best |
| Tone at the top | The example set by leadership | A norm-setting mechanism; the audit tests what leaders do, not what they say |
| Deterrence | Prevention through fear of consequences | Necessary, insufficient; the book’s subject |
| Friction | Structure that slows an action and forces deliberation | The design principle for controls over judgment |
| Vividness | Making the people harmed visible to the decision-maker | A technique for approvals of estimates, pricing and disclosures |
| Compliance measurement | Assessing whether a programme changes behaviour | The audit of the compliance function’s effectiveness, not its activity |
| Speak-up culture | Conditions under which people raise concerns | The hotline is the channel; the culture is the control |
What it means for internal audit: beyond the fraud triangle
The fraud triangle of pressure, opportunity and rationalisation remains the organising model of most fraud risk assessments, and Soltes does not discard it; he changes the weight. Opportunity remains the lever controls can pull, but the book shows that opportunity is created by norms and distance as much as by access, and that rationalisation is often not a precondition but an afterthought. The table maps the findings to the audit activities they change. The fraud risk management guide provides the full framework; the management review controls guide and the professional skepticism guide cover the controls over judgment that the book bears on most.
| Audit activity | What the triangle-based approach does | What the book adds | Procedure it changes |
|---|---|---|---|
| Fraud risk assessment | Scores schemes by pressure, opportunity and rationalisation | Adds norms and distance: where is conduct normalised, and where are the harmed parties invisible to decision-makers? | Two questions per scheme in the assessment template; see the fraud risk guide |
| Management override | Journal entry testing, estimate review, unusual transactions | Override is intuitive and incremental; the first small adjustment is the event | Trend analysis of estimates and reserves across periods, looking for the slope rather than the step |
| Review of management estimates | Reasonableness of the number | Was the reasoning documented before the outcome was known, or constructed afterwards? | Request the contemporaneous support and compare its date with the decision |
| Approval controls | Evidence that approval occurred | Approval without challenge launders the decision | Test what the approver asked, not whether they signed; the management review controls guide‘s precision test |
| Culture and conduct | Code of conduct, training completion, hotline statistics | Norms are what people do; distance is structural | The culture audit‘s observation of practice; a test of whether decisions about customers and counterparties name them |
| Long-running issues | Aged items tracked to closure | The hole: old concealments are the most strongly defended | Prioritise estimates and reconciling items that have persisted for years; see the issue validation guide |
| Compliance programme audit | Policy coverage, training, communications | Measure behaviour change: declines, escalations, exits, reported concerns acted on | Outcome metrics requested from compliance; a finding if none exist |
| Control design over judgment | Segregation, limits, sign-offs | Friction and vividness: a second person, a required question, a delay | Recommendations for judgment-heavy processes framed as pauses rather than signatures |
One further implication concerns the auditor’s own intuitions. The book’s executives were confident, articulate and persuasive, and they persuaded boards, auditors and themselves. An auditor who meets an explanation that is fluent, reasonable and offered without hesitation has met exactly the kind of account the book shows to be constructed after the fact, and the only defence is the documentary one: the reasoning in writing, dated before the result. The professional skepticism guide makes the same point from the auditor’s side.
Fastow’s rule-following, and what it means for a control framework
One case deserves separate treatment because it has become a staple of audit conferences. Andrew Fastow, Enron’s chief financial officer, has spent years since his release telling audiences of accountants and auditors that every structure he built was reviewed by lawyers and auditors, approved by the board, and disclosed in the footnotes, and that this is exactly why it was dangerous: he had followed the rules and violated their purpose, and the approvals had told him he was fine. Soltes’s interviews with him develop the point. Fastow did not experience the partnerships as fraud at the time; he experienced them as clever, as sanctioned, and as what the company needed. The intuitive signal that something was wrong was muted by the number of qualified people who had looked and said nothing.
For an internal audit function the implication is specific. A control framework that consists of approvals confers legitimacy on whatever passes through it, and the more expert the approvers, the stronger the laundering effect. The remedy is not fewer approvals but approvals that leave a record of challenge: what the approver asked, what alternative was considered, what would have led to a refusal. The management review controls guide calls this precision, and the audit committee playbook describes the committee-level version, in which the chair asks management to explain the transaction the board is about to approve in terms a shareholder would recognise. Fastow’s structures would not have survived that question, which is the point of asking it.
The criticisms, and the limits of the evidence
The obvious objection is that the witnesses are convicted fraudsters explaining themselves to a sympathetic professor, and that their accounts of acting without calculation are the most self-serving story available: intuition excuses, calculation condemns. Soltes acknowledges this throughout and treats the interviews as evidence of how the executives think now rather than proof of how they thought then; the argument rests on the convergence of dozens of accounts with the experimental literature on moral judgment, not on any one confession. A second criticism is selection: the people who agreed to talk may differ from those who did not, and the book has no comparison group of executives who faced the same pressures and did not offend, which is the group a prevention programme most needs to understand. A third is that the prescriptive conclusion is thin: friction, vividness and norms are the right direction, and the book offers little on how to build or measure them, which Soltes’s later work on compliance measurement partly addresses.
For an auditor the limits are manageable because the use is diagnostic. The book does not say deterrence is useless or that calculating fraudsters do not exist; the Lying for Money summary covers the deliberate, structural frauds that the economic model does describe. It says that a large class of serious misconduct by senior people follows a different pattern, and that a fraud risk assessment built only on the triangle will not see it coming.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | PublicAffairs, October 2016, about 450 pages | The first edition |
| Paperback | PublicAffairs, March 2019 | The edition most readers own |
| Reading plan | Part two in full; the chapters on deceptive financial structures, insider trading and Madoff; the conclusion | An auditor with two evenings |
| Companion reading | The Thinking, Fast and Slow summary for the psychology of intuition; the Managing the Risk of Fraud and Misconduct summary for the programme side | Placing the argument |
| Related research | Soltes’s later papers on measuring compliance programmes; the Department of Justice’s evaluation guidance for corporate compliance programmes, which asks the same outcome questions | Turning the argument into an audit of compliance |
A one-hour discussion guide for an audit team
- Ten minutes: the slope. Take one management estimate the function reviews annually and plot its history over five years. Discuss whether a gradual drift would have been noticed by the current procedure.
- Fifteen minutes: distance. For the three most judgment-heavy decisions in the organisation (pricing, provisioning, disclosure, or their equivalents), ask who is harmed if the decision is wrong and whether that person is ever named in the approval. Decide whether naming them would change the decision.
- Ten minutes: the approval. Read the last three approvals of a significant estimate. Note whether any record shows the approver asking a question.
- Fifteen minutes: norms. List three practices that are common in the organisation or its industry and that the code of conduct would not obviously permit. Discuss what the function has reported about any of them.
- Ten minutes: the plan. Decide which of the eight procedure changes belong in the next fraud risk assessment and who owns them; the risk assessment guide describes the documentation.
Worked example: Pennine Foods applies the lens to management override
Pennine Foods plc is a fictional UK-listed food group with £900 million of revenue, a December year-end and a four-person internal audit function that reports to an audit committee preparing for its first declaration under Provision 29 of the UK Corporate Governance Code. In 2027 the head of audit used the book’s mechanisms to re-examine the override risk in the financial reporting process, which the existing assessment had covered with journal-entry testing and a review of the largest estimates.
| Mechanism | What the function looked at | What it found | What changed |
|---|---|---|---|
| The slope | Five-year history of the customer-rebate accrual, the largest judgmental estimate | The accrual had been released by a small amount in each of the last nine quarters, each release individually immaterial, cumulatively about half of a quarter’s profit growth | Trend analysis of the top eight estimates added to the quarterly programme; the audit committee asked for the rebate history in its papers |
| Distance | How pricing and rebate decisions were documented | Decisions referred to “the customer” by account code; the retailers’ buyers and the group’s own sales staff, whose bonuses depended on the figures, were nowhere in the papers | The function recommended that estimate approvals state who is affected by an error, in both directions; adopted for the top eight estimates |
| Approval without challenge | The finance director’s sign-off on the estimates | Twelve consecutive sign-offs with no recorded question; the finance director, interviewed, had asked questions in meetings that were not minuted | A one-line record of the question asked and the answer given, added to the sign-off; the management review controls guide cited |
| Norms | Practice around quarter-end shipments | Shipping to the group’s own distribution centres on the last day of the quarter was described by three managers as “what everyone in the sector does” | A cut-off test redesigned around that practice; a conversation between the audit committee chair and the chief executive about the norm |
| Contemporaneous reasoning | Support for a provision release in the prior year | The memo justifying the release was dated two weeks after the release was booked | Finding: estimate support to be dated and filed before posting; the external auditor adopted the same test |
| The hole | Reconciling items older than two years | Three items totalling £1.1 million had been carried for four years with the same explanation | Resolved within the half-year; two were errors that had been protected by their age |
None of this was a fraud. The function reported that the override risk in the reporting process was higher than the previous assessment had suggested, for reasons that had nothing to do with anyone’s dishonesty and everything to do with the mechanisms the book describes: a slope nobody was plotting, decisions taken at a distance from the people affected, approvals that signed without asking, a sector norm that nobody had examined, and old items whose age had become their justification. The audit committee’s response was to adopt the changes and to ask the function to repeat the exercise annually. That is the book’s argument put to work: the controls that matter over judgment are the ones that interrupt intuition, and most organisations have fewer of them than they think.
Frequently asked questions
Does the book excuse white-collar criminals?
No, and Soltes is explicit about it. Explaining how a decision was made is not the same as excusing it; the book’s purpose is prevention, and prevention requires an accurate model of the offender.
How does it relate to the fraud triangle?
It keeps opportunity as the lever, reinterprets pressure as the norms and intuitions of the environment rather than a conscious motive, and argues that rationalisation is often constructed after the act. The fraud risk guide shows how to add the book’s questions to a triangle-based assessment.
What is the single most useful control idea?
Friction: a second person, a required question, a delay, a named victim. Structures that turn an intuitive act into a deliberate one are where the book says prevention happens.
Which cases does it cover?
Madoff, Fastow, Kozlowski, Marc Dreier and Allen Stanford among others, organised by type of crime; the corporate scandals guide places several of them in a comparative table.
Is it relevant outside financial reporting?
Yes: bribery, insider trading, conflicts of interest and procurement fraud all follow the pattern of distance and norms. The BSA/AML audit guide and the third-party risk guide cover processes where the mechanisms operate.
Where does the book sit in the reading list?
In the fraud and ethics group of the internal audit reading list, with Lying for Money for the structural frauds and the scandal narratives for the cases.
Related guides
- Fraud Risk Management: Assessment, Controls and Analytics — the framework the book’s questions join
- Management Review Controls: Documenting Precision — approval that asks a question
- How to Audit Corporate Culture — testing norms rather than codes
- Professional Skepticism: The Auditor’s Stance — the defence against fluent explanations
- Lying for Money: Summary and Lessons for Auditors — the deliberate frauds the economic model does describe
- Corporate Scandals and the Internal Audit Lessons — the cases in comparison
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- No One Would Listen by Harry Markopolos: Summary and Lessons for Auditors — Madoff and the warnings the SEC did not act on
- Blind Spots by Bazerman and Tenbrunsel: Summary and Lessons for Auditors — why decent people miss the ethics of their own decisions.
Leave a Reply